additional memory leaks, overflow and unchecked ...

return values fixed

thanks to iceman1001
This commit is contained in:
marshmellow42 2016-02-14 13:24:03 -05:00
parent 568377946c
commit 8ea5706047
2 changed files with 15 additions and 7 deletions

View file

@ -875,6 +875,7 @@ int CmdHF14AMfChk(const char *Cmd)
break;
default:
PrintAndLog("Key type must be A , B or ?");
free(keyBlock);
return 1;
};
@ -926,6 +927,7 @@ int CmdHF14AMfChk(const char *Cmd)
if (!p) {
PrintAndLog("Cannot allocate memory for defKeys");
free(keyBlock);
fclose(f);
return 2;
}
keyBlock = p;
@ -1219,7 +1221,7 @@ int CmdHF14AMfELoad(const char *Cmd)
if (numblk2 > 0) numBlocks = numblk2;
len = param_getstr(Cmd,nameParamNo,filename);
if (len > FILE_PATH_SIZE - 4) len = FILE_PATH_SIZE - 4;
if (len > FILE_PATH_SIZE - 5) len = FILE_PATH_SIZE - 5;
fnameptr += len;
@ -1316,7 +1318,7 @@ int CmdHF14AMfESave(const char *Cmd)
len = param_getstr(Cmd,nameParamNo,filename);
if (len > FILE_PATH_SIZE - 4) len = FILE_PATH_SIZE - 4;
if (len > FILE_PATH_SIZE - 5) len = FILE_PATH_SIZE - 5;
// user supplied filename?
if (len < 1) {
@ -1593,7 +1595,7 @@ int CmdHF14AMfCLoad(const char *Cmd)
return 0;
} else {
len = strlen(Cmd);
if (len > FILE_PATH_SIZE - 4) len = FILE_PATH_SIZE - 4;
if (len > FILE_PATH_SIZE - 5) len = FILE_PATH_SIZE - 5;
memcpy(filename, Cmd, len);
fnameptr += len;
@ -1762,7 +1764,7 @@ int CmdHF14AMfCSave(const char *Cmd) {
return 0;
} else {
len = strlen(Cmd);
if (len > FILE_PATH_SIZE - 4) len = FILE_PATH_SIZE - 4;
if (len > FILE_PATH_SIZE - 5) len = FILE_PATH_SIZE - 5;
// get filename based on UID
if (len < 1) {
@ -1906,6 +1908,11 @@ int CmdHF14AMfSniff(const char *Cmd){
bufsize = traceLen;
memset(buf, 0x00, traceLen);
}
if (bufPtr == NULL) {
PrintAndLog("Cannot allocate memory for trace");
free(buf);
return 2;
}
memcpy(bufPtr, resp.d.asBytes, len);
bufPtr += len;
pckNum++;

View file

@ -23,7 +23,7 @@ int ukbhit(void)
static struct termios Otty, Ntty;
tcgetattr( 0, &Otty);
if ( tcgetattr( 0, &Otty) == -1 ) return -1;
Ntty = Otty;
Ntty.c_iflag = 0; /* input mode */
@ -140,8 +140,9 @@ char *sprint_bin_break(const uint8_t *data, const size_t len, const uint8_t brea
size_t in_index = 0;
// loop through the out_index to make sure we don't go too far
for (size_t out_index=0; out_index < max_len; out_index++) {
// set character
sprintf(tmp++, "%u", data[in_index]);
// set character - (should be binary but verify it isn't more than 1 digit)
if (data[in_index]<10)
sprintf(tmp++, "%u", data[in_index]);
// check if a line break is needed and we have room to print it in our array
if ( (breaks > 0) && !((in_index+1) % breaks) && (out_index+1 != max_len) ) {
// increment and print line break